Data Protection and Data Retention - Revision history

Philip Lacey at 03:58, 3 February 2017

2017-02-03T03:58:52Z

Patrick Jenkins: /* bxp Scheduling Engine Process [Scheduled] */

2016-03-16T09:33:20Z

‎bxp Scheduling Engine Process [Scheduled]

Patrick Jenkins: /* Tools for Data Protection automation */

2016-03-16T09:31:21Z

‎Tools for Data Protection automation

Philip Lacey at 22:13, 9 November 2014

2014-11-09T22:13:06Z

Philip Lacey at 19:39, 9 November 2014

2014-11-09T19:39:16Z

Philip Lacey at 12:29, 13 July 2014

2014-07-13T12:29:06Z

Philip Lacey at 13:29, 12 July 2014

2014-07-12T13:29:47Z

Philip Lacey at 13:28, 12 July 2014

2014-07-12T13:28:17Z

Philip Lacey at 13:25, 12 July 2014

2014-07-12T13:25:12Z

Philip Lacey at 13:18, 12 July 2014

2014-07-12T13:18:41Z

@@ Line 279: / Line 279: @@
 The JavaScript rules can be put in place at a form, field or outcome level.
@@ Line 285: / Line 286: @@
 Using the MetaData module it is possible to build a rule set to modify data which can be executed on a scheduled basis.  For example: every day, wipe records that have not been interacted with in more than 6 months.
@@ Line 290: / Line 292: @@
-Using the scheduling engine of bxp, any user who has access to a form and has access to the form management module can create a scheduled data protection process.
+It is possible for any form to have data wiping / record deleting capability applied on a scheduled basis.  Please read here for more details. [[Form_-_Data_Protection_-_Scheduled]]
 == Summary ==

← Older revision		Revision as of 09:33, 16 March 2016
Line 312:		Line 312:


−	To enable this function simply navigate to the advanced settings of the form you wish to enable this functionality for and open the section ''Scheduled Data Protection'', and enter in your desired settings.	+	To enable this function simply navigate to the advanced settings of the form you wish to enable this functionality for and open the section ''Scheduled Data Protection'', and enter in your desired settings. Please note in order to download the encrypted data file, you will need to contact the support team of bxp so an SFTP account can be created, so you can download the file.

← Older revision		Revision as of 09:31, 16 March 2016
Line 286:		Line 286:
	Using the MetaData module it is possible to build a rule set to modify data which can be executed on a scheduled basis. For example: every day, wipe records that have not been interacted with in more than 6 months.		Using the MetaData module it is possible to build a rule set to modify data which can be executed on a scheduled basis. For example: every day, wipe records that have not been interacted with in more than 6 months.

		+
		+	=== bxp Scheduling Engine Process [Scheduled] ===
		+
		+
		+	Using the scheduling engine of bxp, any user who has access to a form and has access to the form management module can create a scheduled data protection process.
		+	This scheduled process takes a number of parameters.
		+
		+	* Enable the process
		+	* Execution frequency (Yearly/Monthly/Weekly/Daily)
		+	* Time of execution (15 minute intervals between 06:00:00 and 22:00:00)
		+	* Fields to wipe (Fields separated by ,'s i.e. strCDA_X_field_0_1,strCDA_X_field_0_2,strCDA_X_field_0_5)
		+	* Time frame for data wipe (All/Delta)
		+	* Password for encrypted file
		+	* Send notification email
		+	* Email notification list (Email addresses separated by ,'s i.e. patrick.jenkins@allnone.ie,philip.lacey@allnone.ie)
		+
		+
		+	Provided that the details above have been entered correctly a scheduled instruction will be created for the following day with the time period selected.
		+	When the scheduled instruction is executed, the following sequences will be executed on the desired database.
		+
		+	* Perform a complete data dump of the records in the form for the time period selected
		+	* ZIP and encrypt the data file for collection by the bxp client
		+	* Wipe the contents of the outlined fields
		+	* provided that the email notification function is enabled, bxp will generate stats on the scheduled process and email these to the specified accounts.
		+
		+
		+	To enable this function simply navigate to the advanced settings of the form you wish to enable this functionality for and open the section ''Scheduled Data Protection'', and enter in your desired settings.
		+
		+
		+	[[File:ScheduledDataProtectionSettings.png\|800px]]
		+
		+
		+	'''Example Email notification'''
		+
		+	[[File:ScheduledDataProtectionEmail.png]]

	== Summary ==		== Summary ==

← Older revision		Revision as of 22:13, 9 November 2014
Line 296:		Line 296:
	[[Category:Module Specific:System Access Management]]		[[Category:Module Specific:System Access Management]]
	[[Category:Topic:Security]]		[[Category:Topic:Security]]
		+	[[Category:Topic:Data Cleaning]]

← Older revision		Revision as of 19:39, 9 November 2014
Line 290:		Line 290:

	All n One have been extremely careful to position the security and data protection compliance of bxp software in line with the strictest of laws and rules. All of our team are versed in Data Protection and its requirements. We would be happy to help you identify and navigate your data protection requirements and are completely confident that bxp software is a platform that can provide you with every tool required.		All n One have been extremely careful to position the security and data protection compliance of bxp software in line with the strictest of laws and rules. All of our team are versed in Data Protection and its requirements. We would be happy to help you identify and navigate your data protection requirements and are completely confident that bxp software is a platform that can provide you with every tool required.
		+
		+
		+
		+	[[Category:Topic:About bxp]]
		+	[[Category:Module Specific:System Access Management]]
		+	[[Category:Topic:Security]]

← Older revision	Revision as of 12:29, 13 July 2014
Line 4:	Line 4:


	+	== Summary Document Links ==
	+
	+	This section is for handy location of supporting documentation used throughout this article.
	+
	+	* Data Protection Guidelines from the Irish Data Protection Commissioner - [http://www.dataprotection.ie/ViewDoc.asp?fn=/documents/responsibilities/3bii.htm&CatID=54&m=y]
	+	* Whitepaper : Data Protection Compliance for bxp software clients - [[Whitepapers]]
	+	* Learning : CC-2-1 Security and Custom Interface configuration - [[Contact_Centre_Training]]

← Older revision		Revision as of 13:29, 12 July 2014
Line 175:		Line 175:


−	== ~~Tool~~ for Data Protection automation ==	+	== Tools for Data Protection automation ==

@@ Line 144: / Line 144: @@
 * State how access control to that data is maintained
-** bxp provides the "System Access Management" (SAM) module to control user access to functions and content.  Please review our training document CC-2-1 Security and Custom Interface configuration [[Contact_Centre_Training]] for more details on this.
+** bxp provides the "System Access Management" (SAM) module to control user access to functions and content.  Please review our training document ''CC-2-1 Security and Custom Interface configuration'' on the page [[Contact_Centre_Training]] for more details on this.
 ** SAM also provides the audit trail reports.
 * State how security is managed on that data
 ** If stored in bxp that removes the need for you to store data locally.
-** bxp provides secure storage.  Please review our white paper on Data Protection Compliance [[Whitepapers]] for more details on our facilities and approaches to security of your data.
+** bxp provides secure storage.  Please review our white paper on ''Data Protection Compliance'' in our [[Whitepapers]] section for more details on our facilities and approaches to security of your data.
 * Appoint a person internal to the organisation to be responsible for data protection matters (DPO: Data Protection Officer)

@@ Line 1: / Line 1: @@
-bxp software (bxp) makes it easy for you to retain data securely and have it accessible through the Internet.  It is however important to always remember that if you are storing personal information about a person ( customer or potential customer, member, staff, student, patient), what data you're storing and why you're storing it falls under Data Protection and you (not All n One), have to ensure you are compliant with local Data Protection laws.
+bxp software (bxp) makes it easy for you to retain data securely and have it accessible through the Internet.  It is however important to always remember that if you are storing information about a person ( customer or potential customer, member, staff, student, patient), what data you're storing and why you're storing it falls under Data Protection and you (not All n One), have to ensure you are compliant with local Data Protection laws.
 That said, All n One and bxp can help greatly with your management responsibilities.
@@ Line 24: / Line 24: @@
-Ireland is one of the leading countries in setting data protection law.  All n One is an Irish company with all of its operations and infrastructure based in Ireland managed by Irish companies.  For location reasons we must be compliant with Irish law and as an organisation we want to comply with the strongest legislation available.
+Ireland is one of the leading countries in setting data protection law.  All n One is an Irish company with all of its operations and infrastructure based in Ireland.  For location reasons we must be compliant with Irish law and as an organisation we want to comply with the strongest legislation available.
@@ Line 33: / Line 33: @@
-It is also advisable that you register your organisation with your local data protection commissioner.
+All n One advise you to register your organisation with your local data protection commissioner.
@@ Line 53: / Line 53: @@
-As a result of those conversations you will need to develop a "data retention policy" for your organisation.  This will spell out your data retention requirements.
+As a result of those conversations you will need to develop a "data protection policy" for your organisation.  This will spell out your data retention requirements.
@@ Line 79: / Line 79: @@
 Customer data of active customers is perfectly legitimate to retain.  Just focus on what constitutes "active".
-Data of former customers will have a retention period applied.  Local will dictate what is required and where.
+Data of former customers will have a retention period applied.  Local law will dictate what is required and where.
 Potential customers may ask for their data to be removed but there is no pressure on the organisation to remove data.
@@ Line 116: / Line 116: @@
-For example.... I have a bunch of mobile numbers, I'd like to text them all.  You must first categorise them, ensure you have permission and then careful word the message to allow opt out.  Failure to do so can result in €3,000 per contact, up to a maximum fine of €100,000.
+For example.... I have a bunch of mobile numbers, I'd like to text them all.  You must first categorise them, ensure you have permission and then carefully word the message to allow opt out.  Failure to do so can result in €3,000 per contact, up to a maximum fine of €100,000.
@@ Line 151: / Line 151: @@
 ** bxp provides secure storage.  Please review X for more details on our facilities and approaches to security of your data.
-* Appoint a person internal to the organisation to be responsible for data protection matters (DPO : Data Protection Officer)
+* Appoint a person internal to the organisation to be responsible for data protection matters (DPO: Data Protection Officer)
 * Ensure the DPO is trained formally according to jurisdictional laws and on an ongoing basis
@@ Line 161: / Line 161: @@
 * Have an organisation statement on data retention and management, which is recognised by all staff and suppliers interacting with the data
 ** The "Information Centre" module allows you to post notices on the equivalent of an internal noticeboard and track who has confirmed read of the message.
-** The "eCourse" module allows for training courses to be built internally, provided to staff.  The "Testing Centre" module allows for confirmation of the learning.
+** The "eCourse" module allows for training courses to be built internally, and then provided to staff.  The "Testing Centre" module allows for confirmation of the learning.
 * Have operational policies and procedures on how the data is managed
 ** "eCourse" will allow for documentation of policy and procedures and audit access by staff to ensure reading and retention
-** The "MetaData" module allows for procedures to be built to clean and tidy data.  When tied into the scheduling engine of bxp data protection process can be automated.
+** The "MetaData" module allows for procedures to be built to clean and tidy data.  When tied into the scheduling engine of bxp the data protection process can be automated.
 * Have quality control checks to ensure policies are being followed
@@ Line 216: / Line 216: @@
 If no flag is easily identifiable on the data in the form there is a process which can be applied.
-* Add a flag field to the form usually a text box will suffice.
+* Add a flag field to the form, usually a text box will suffice.
 * Run a report to Excel of all the potential data.  Ensure that the CDA Id is one of the columns in the report.
 * In the excel file, update the flag field with a code or word to group / categorise the data to be deleted.
@@ Line 232: / Line 232: @@
 ''Main Menu > Form - Form and Data Deletion > Data Deletion - Data Protection - Remove records older than selected data > Choose the form > Choose the date''
-So if no email, sms or any type of contact (i.e. a CCL record) has been stored within the selected time window, the record and all contact with it, will be removed.
+So if no email, sms or any type of contact (i.e. a CCL record) has been stored within the selected time window, the record and all contact with it will be removed.
@@ Line 269: / Line 269: @@
-Unlike "Data manipulation via Outcomes", JavaScript can be used in the client browser to manipulate data before is ever sent to bxp.  This level of manipulation usually allows for Credit Card details and the like to be wiped / modified before they are ever transmitted.
+Unlike "Data manipulation via Outcomes", JavaScript can be used in the client browser to manipulate data before it is ever sent to bxp.  This level of manipulation usually allows for Credit Card details and the like to be wiped / modified before they are ever transmitted.
 The JavaScript rules can be put in place at a form, field or outcome level.
@@ Line 277: / Line 277: @@
-Using the MetaData module it is possible to build a rule set to modify data which can be caused to be executed on a scheduled basis.  For example: every day, wipe records that have not been interacted with in more than 6 months.
+Using the MetaData module it is possible to build a rule set to modify data which can be executed on a scheduled basis.  For example: every day, wipe records that have not been interacted with in more than 6 months.